Search results

[…] customer interacts with the provider’s interface for authentication and authorization. The customer is routed to the provider’s interface via the DAP. The DAP pulls the data through APIs to the recipient. I’ve been looking for a service like this! DATA PROVIDERSCompanies like banks or card issuers that hold customer financial data. $DATA RECIPIENTSCompanies that […]

[…] online service’s purpose, the categories of personal data processed, and the processing purposes. Data protection assessments should be reviewed “as necessary” to account for material changes, and documentation should be retained for either 3 years after the processing operations cease, or the date on which the controller ceases offering the online service, whichever is […]

Analysis and Commentary: “Re-identification” of Governor William Weld ©DCB-J July, 2012 1 The “Re-identification” of Governor William Weld’s Medical Information: A Critical Re-examination of Health Data Identification Risks and Privacy Protections, Then and Now Author: Daniel C. Barth-Jones, M.P.H., Ph.D., Assistant Professor of Clinical Epidemiology, Department of Epidemiology, Mailman School of Public Health, Columbia University. […]

[…] the design of APIs (Application Programming Interfaces), which can act as critical shields between raw data and external access. Re-identification attempts can be partially mitigated at the API level through strict query limits, access controls, auditing mechanisms, and purpose restrictions—complementing the privacy-enhancing technologies discussed throughout this paper. These architectural choices embed ethical values and […]

[…] and after being placed on the market and throughout their use.  The CA should be understood as a framework of assessments (both technical and non-technical), requirements, and documentation obligations. The provider should assess whether the AI system poses a high risk and identify both known and potential risks as part of their risk management […]

[…] a risk management system (RMS) in place? …………… 24 4.2. Were high-quality datasets used for training, validation, and testing? (Article 10 AIA) …………………………………………. 27 4.3. Has technical documentation been drawn up? (Article 11 AIA) … 29 4.4. Is the automatic recording of events (‘logs’) possible? (Article 12 AIA) ………………………………………………….. 30 4.5. Is the AI […]

On 21 January 2025, South Korea became the first jurisdiction in the Asia-Pacific (APAC) region to adopt comprehensive artificial intelligence (AI) legislation. Taking effect on 22 January 2026, the Framework Act on Artificial Intelligence Development and Establishment of a Foundation for Trustworthiness (AI Framework Act or simply, Act) introduces specific obligations for “high-impact” AI systems […]

[…] law protecting fundamental rights, including the right to non-discrimination, in relation to the use of high-risk AI systems referred to in Annex III.• Request and access any documentation created or maintained in relation to the use of a high-risk AI system falling under Annex III, provided that this is necessary for effectively fulfilling their […]

[…] law protecting fundamental rights, including the right to non-discrimination, in relation to the use of high-risk AI systems referred to in Annex III.• Request and access any documentation created or maintained in relation to the use of a high-risk AI system falling under Annex III, provided that this is necessary for effectively fulfilling their […]

[…] recommendations and discounts) d. Will it replace some expensive expert skill? (e.g. reading MRI scans) e. Will it make information more accessible? (e.g. chatbot to access tech documentation) 2 If the assessment is being conducted during the development/fine tuning or post-development phase, document the existence and context of risks in system testing. a. Create […]